Page 1 of 1

File location on disk

Posted: Fri Mar 13, 2020 3:50 pm
by KenL
Hi,

Since the search engine for the forum only recognizes keywords and not phrases, I get hundreds of unrelated results when searching for "file location" or "save file names advanced options". So I apologize if this has been answered.

While photorec saves raw files with the filename "fxxxxxxxxxxx" where xxxxxxxxxxx is the disk sector where the file starts, R-Studio just names them in sequential order. How do I find out the file location on the disk? I'm working on NTFS volumes, and if the MFT is intact, I've been able to do it manually from the MFT record number (by finding the record number in the MFT and getting the offset to the data runs).

In the help file, it gives an example of the information saved when using "save file names" that includes MFT number and regions (see below). But I only get a list of file names. The help file also refers to "advanced options" in the "save file names" dialog box that is not there.

While I understand that RAW files won't be linked to the MFT, aside from searching the disk in the hex editor for a unique section of the file data stream, is there any way to report the file location (e.g. number of bytes offset from the start of the volume)?

Structure of a file recovery list file created by R-Studio
An example of such a file:
sort: by real
:# PathDelim = \
Docs\
:! Id: 4587531
:! Flags: directory
:! Created: 2011-04-05T22:42:13
:! Modified: 2011-04-05T22:42:13
:! Accessed: 2011-04-05T22:42:13
:! MFT number: 70
:! Parent MFT number: 5
:! Regions (sector size=512B): sector 2433976 (offset: 50 )
:! size: 2 Bytes / residentsector 2433976 (offset: 80 )
:! size: 72 Bytes / residentsector 2433976 (offset: 176 )
:! size: 74 Bytes / residentsector 2433976 (offset: 288 )
:! size: 222 Bytes / residentsector 2433977
:! size: 136 Bytes / resident

Docs\MyDoc1.odt
:! Id: 4653067
:! Flags: valid first data offset
:! Created: 2011-04-05T22:42:13
:! Modified: 2011-03-01T17:41:14
:! Accessed: 2011-04-05T22:42:13
:! File type: OpenOffice Writer Document
:! Recovery chances: Good (Existing file)
:! MFT number: 71
:! Parent MFT number: 70
:! Regions (sector size=512B): sector 2268
:! size: 24 KB (24,576 Bytes) / first datasector 2433978 (offset: 80 )
:! size: 72 Bytes / residentsector 2433978 (offset: 176 )
:! size: 86 Bytes / resident

Docs\MyDoc2.odt
:! Id: 4718603
:! Flags: valid first data offset
:! Created: 2011-04-05T22:42:13
:! Modified: 2011-02-28T23:31:02
:! Accessed: 2011-04-05T22:42:13
:! File type: OpenOffice Writer Document
:! Recovery chances: Good (Existing file)
:! MFT number: 72
:! Parent MFT number: 70
:! Regions (sector size=512B): sector 2316
:! size: 24 KB (24,576 Bytes) / first datasector 2433980 (offset: 80 )
:! size: 72 Bytes / residentsector 2433980 (offset: 176 )
:! size: 86 Bytes / resident

Docs\MyDoc3.odt
:! Id: 4784139
:! Flags: valid first data offset
:! Created: 2011-04-05T22:42:13
:! Modified: 2011-02-28T23:31:10
:! Accessed: 2011-04-05T22:42:13
:! File type: OpenOffice Writer Document
:! Recovery chances: Good (Existing file)
:! MFT number: 73
:! Parent MFT number: 70
:! Regions (sector size=512B): sector 2020080
:! size: 177.38 MB (185,991,168 Bytes) / first datasector 2433982 (offset: 80 )
:! size: 72 Bytes / residentsector 2433982 (offset: 176 )
:! size: 86 Bytes / resident

Re: File location on disk

Posted: Sat Mar 14, 2020 2:17 pm
by Alt
KenL wrote:
Fri Mar 13, 2020 3:50 pm
In the help file, it gives an example of the information saved when using "save file names" that includes MFT number and regions (see below). But I only get a list of file names. The help file also refers to "advanced options" in the "save file names" dialog box that is not there.
The advanced options are for the Technician version. We'll include this warning in our next help. Also, the Technician version shows the location information about a specific file in its Get info panel.

Re: File location on disk

Posted: Tue Jun 02, 2020 8:09 pm
by abolibibelot
It would still be very useful if the naming scheme for “extra found files” used a fixed pattern based on the file's physical or logical location. When performing a new scan with different options (in particular : different file types enabled / disabled), or with a new version of R-Studio, it would allow to know right away if a file appearing in R-Studio's explorer is the same as one previously extracted with the same type and size, or not, or if two files of the same type identified by different versions of R-Studio with a different size correspond in fact to the same header, meaning that each version treated that file differently. (For instance, I've seen instances where two AVI files were identified as a single file by an older version of R-Studio, while a newer version correctly identified the header of the second file, so, with such a naming scheme, it would have been clear that file 12345678.avi starting at sector 12345678 with a size of 1400MB was in fact containing both file 12345678.avi and file 13779278.avi, with sizes of 700MB each, identified by the newer version.)